leocrm/quality-gate-phase2-r2.md

LeoCRM — Quality Gate Phase 2 (Architecture) Re-Review (Round 2)

Reviewer: Quality Reviewer (Agent Zero) Datum: 2026-06-28 Phase: Phase 2 — Architecture + Task Graph + AGENTS.md Previous Review: quality-gate-phase2.md (Round 1, BLOCKED — 3 Critical, 5 Major, 3 Minor) Verdict: ⚠️ APPROVED_WITH_SUGGESTIONS — 0 Critical, 1 Major, 2 Minor

---

Fix Verification Summary (11 Issues from Round 1)

#	Issue	Severity (R1)	Fix Status	Evidence
1	F-AI-01 (KI-Copilot) missing	CRITICAL	✅ FIXED	Architecture §8b (lines 1483-1530): API endpoints, RBAC enforcement, DB table ai_conversations, frontend integration. Task T09 covers F-AI-01 with 22 acceptance criteria + test_spec.
2	F-WF-01 (Hybrid-Workflow-Engine) missing	CRITICAL	✅ FIXED	Architecture §8c (lines 1538-1620): Hybrid approach (code-engine + configurable), API endpoints, DB tables workflows/workflow_instances/workflow_step_history. Task T09 covers F-WF-01 with 22 acceptance criteria + test_spec.
3	Session-Storage contradiction	CRITICAL	✅ FIXED	§6 (line 200-210): sessions table labeled "Audit Trail — primary session store is Redis" with clear note. ADR-05 (line 1871): "Server-side sessions in Redis (primary store), PostgreSQL sessions table retains session records as an audit trail." Session creation flow (line 1242-1243): Redis key + PostgreSQL audit record. Consistent across all three locations.
4	19 v1 Features without traceability	MAJOR	✅ FIXED	All 19 features verified in task_graph requirement_ids: F-NAV-01, F-SET-01, F-UI-01-06, F-UI-08, F-SEC-02, F-SEC-03, F-SCHED-01, F-DATA-03, F-DATA-04, F-DATA-06, F-ENV-01, F-INFRA-02, F-INFRA-03, F-TEST-01 — all present (grep count ≥1).
5	F-DOC-01 (Dokumentation) missing	MAJOR	✅ FIXED	Task T10 covers F-DOC-01: README.md, docs/admin-guide.md, docs/api-overview.md with 3 acceptance criteria + test command.
6	F-INFRA-04 (Monitoring & Alerting) missing	MAJOR	✅ FIXED	Architecture §8d (lines 1662-1710): Health endpoint, Prometheus metrics, alerting rules, structured logging. Task T10 covers F-INFRA-04 with 5 acceptance criteria.
7	F-PERF-01 (Performance) missing	MAJOR	✅ FIXED	Architecture §8e (lines 1714-1770): DB indexing strategy, query optimization, frontend performance, performance tests. Task T10 covers F-PERF-01 with 6 acceptance criteria.
8	F-CONT-08 phantom in task_graph	MAJOR	✅ FIXED	grep -n 'F-CONT-08' task_graph.json returns 0 results. Phantom removed.
9	api_tokens table not in DB schema	MINOR	✅ FIXED	DB Schema §2 (line 366-380): api_tokens table defined with id, tenant_id, user_id, token_hash, name, scopes (JSONB), expires_at, last_used_at, created_at, revoked_at. Index on (tenant_id, user_id) and (token_hash).
10	CSP-Header not mentioned	MINOR	✅ FIXED	Architecture §6 (lines 1284-1291): Full CSP header in Nginx config, plus X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, HSTS, Referrer-Policy, DOMPurify sanitization.
11	Typo line 1033 (```n)	MINOR	✅ FIXED	grep -n '```n' architecture.md returns 0 results. No malformed code fences found.

Fix Score: 11/11 resolved. All critical and major issues from Round 1 are fixed.

---

Original 10 Criteria Re-Check

#	Kriterium	R1 Result	R2 Result	Change
1	Architecture.md deckt alle 10 Bereiche ab	✅ PASS	✅ PASS	No change — all 10 areas present, plus 4 new sub-sections (§8b-§8e)
2	Task Graph: 6-8 substantielle Tasks	✅ PASS	✅ PASS	10 tasks (was 8). T09 (700 lines) and T10 (500 lines) are substantielle. Acceptable expansion.
3	143/143 Features abgedeckt	❌ FAIL	✅ PASS	All 134 v1 features covered (140 total - 6 v2). 0 phantom. Coverage summary count is incorrect (see MINOR-2).
4	AGENTS.md: Commands, Forbidden Patterns, Task-Zuweisung	✅ PASS	⚠️ PARTIAL	Commands ✅, Forbidden patterns ✅, but Task-Zuweisung table and Phasen-Plan missing T09/T10 (see MAJOR-1).
5	Keine Widersprüche arch.md ↔ requirements.md	⚠️ PARTIAL	✅ PASS	All gaps closed: F-AI-01 §8b, F-WF-01 §8c, F-INFRA-04 §8d, F-PERF-01 §8e, F-SEC-02 CSP.
6	Keine Widersprüche task_graph.json ↔ arch.md	⚠️ PARTIAL	✅ PASS	F-CONT-08 phantom removed. api_tokens table in DB schema. Task endpoints match architecture API design.
7	Multi-Tenant (tenant_id) konsistent	✅ PASS	✅ PASS	No change. All tables have tenant_id. New tables (ai_conversations, workflows, workflow_instances, workflow_step_history) also have tenant_id.
8	Plugin-System als v1-Core-Feature	✅ PASS	✅ PASS	No change.
9	PostgreSQL 16, React 18 SPA, FastAPI	✅ PASS	✅ PASS	No change.
10	Session-Auth + API-Token separat	⚠️ PARTIAL	✅ PASS	Session storage contradiction resolved. Redis primary + PostgreSQL audit trail consistent across §6, ADR-05, and session creation flow. api_tokens table in DB schema.

Gesamt: 8 PASS, 1 PARTIAL, 0 FAIL → APPROVED_WITH_SUGGESTIONS

---

New Findings (Round 2)

MAJOR-1: AGENTS.md not updated for T09 and T10

• Artifact: AGENTS.md
• Location: Lines 377-398 (Phasen-Plan + Task Assignment table), Line 484 (Release Gate)
• Issue: AGENTS.md still references only 8 tasks (T01-T08) in 5 phases. The task_graph.json has been expanded to 10 tasks (T01-T10) in 6 phases. The following sections are out of sync:
  • Phasen-Plan table (line 381-385): Missing Phase 6 (T10) and T09 in Phase 3
  • Task Assignment table (line 391-398): Missing rows for T09 and T10
  • Release Gate (line 484): Says "All 8 tasks complete" — should say "All 10 tasks complete"
  • Block Rules (line 412): Says "After 3 blocks (9 tasks)" — should reference 10 tasks
• Recommendation:
  1. Add T09 to Phasen-Plan Phase 3 (parallel with T04, T05, T06)
  2. Add Phase 6 with T10 to Phasen-Plan
  3. Add T09 and T10 rows to Task Assignment table
  4. Update Release Gate to "All 10 tasks complete"
  5. Update Block Rules to reference 10 tasks (4 blocks)
• Block transition: NEIN — does not block implementation start, but must be fixed before Phase 3 execution

MINOR-1: Architecture section numbering (§8b-§8e under §8)

• Artifact: architecture.md
• Location: Lines 1483, 1538, 1662, 1714
• Issue: New sections §8b (KI-Integration), §8c (Workflow Engine), §8d (Monitoring), §8e (Performance) are sub-sections of §8 (Deployment Architecture). Topically, KI-Integration and Workflow Engine are architecture concerns, not deployment concerns.
• Recommendation: Consider renumbering as §11 (KI-Integration), §12 (Workflow Engine), or as sub-sections of §1 (System Architecture). Not blocking — content is correct and well-structured.

MINOR-2: feature_coverage_summary count incorrect

• Artifact: task_graph.json
• Location: Line 556 ("total_features": 143)
• Issue: The summary states 143 total features, but requirements.md contains 140 unique feature IDs. Of these, 6 are [v2-Plugin] (F-FILE-01-04, F-FILEUI-05-06), leaving 134 v1 features — all covered by tasks. The note says "6 v2-Plugin features excluded" but the total count is wrong (143 should be 140).
• Recommendation: Change "total_features": 143 to "total_features": 140 and update the note to say "134 v1 features covered, 6 v2-Plugin features excluded".

---

Severity Summary

Severity	Count	Details
CRITICAL	0	—
MAJOR	1	AGENTS.md not updated for T09/T10
MINOR	2	Section numbering, feature_coverage_summary count
SUGGESTION	0	—

---

Detailed Fix Verification

✅ CRITICAL-1 (FIXED): F-AI-01 — KI-Copilot

Architecture §8b (lines 1483-1530):

• API-First-Design als Grundlage documented ✅
• 3 API Endpoints: /api/v1/ai/copilot/query, /api/v1/ai/copilot/history, /api/v1/ai/copilot/execute ✅
• RBAC-Durchsetzung: 5 points (Auth via session, RBAC middleware, field-level permissions, tenant isolation, audit log) ✅
• Implementation-Modell v1: Query/Execute/History + LLM config via env vars ✅
• Frontend-Integration: Sidebar entry, chat interface, confirmation dialog ✅
• DB table ai_conversations with tenant_id, user_id, role, content, proposed_actions (JSONB) ✅
• Test file test_ai_copilot.py listed in test tree ✅

Task T09 (lines 426-467):

• F-AI-01 in requirement_ids ✅
• 7 acceptance criteria for Copilot (query, execute, RBAC, history, audit, tenant, field-level) ✅
• test_spec with 3 commands + 2 test files ✅
• Coverage target: 80% ✅

✅ CRITICAL-2 (FIXED): F-WF-01 — Hybrid-Workflow-Engine

Architecture §8c (lines 1538-1620):

• Hybrid-Ansatz: Code-Engine (hardcoded Python workflows) + Configurable Engine (user-defined via Admin-UI) ✅
• 10 API Endpoints for workflow management ✅
• 3 DB tables: workflows (definition with JSONB steps), workflow_instances (running), workflow_step_history (audit trail) ✅
• Step JSONB structure documented with example (action, approval, notification types) ✅
• All tables have tenant_id ✅

Task T09 (lines 426-467):

• F-WF-01 in requirement_ids ✅
• 14 acceptance criteria for Workflow (CRUD definitions, instances, advance/approve/reject/cancel, event trigger, step history, code-engine, timeout) ✅
• test_spec includes test_workflows.py ✅

✅ CRITICAL-3 (FIXED): Session-Storage Contradiction

• §6 sessions table (line 200): Labeled "Audit Trail — primary session store is Redis" ✅
• Note (line 210): "Session lookup at runtime uses Redis (session:{id} with TTL=8h). This PostgreSQL table is an immutable audit trail." ✅
• Session creation flow (lines 1242-1243): "Create session in Redis (key: session:{session_id}, TTL=8h)" + "Write session record to PostgreSQL sessions table for audit trail" ✅
• ADR-05 (line 1871): "Server-side sessions in Redis (primary store for fast lookup), session ID in HttpOnly+Secure+SameSite=Strict cookie. PostgreSQL sessions table retains session records as an audit trail" ✅
• All three locations are now consistent: Redis = primary session store (fast lookup, TTL), PostgreSQL = immutable audit trail ✅

✅ MAJOR-1 (FIXED): 19 v1 Features without traceability

All 19 previously-missing features verified present in task_graph requirement_ids:

Feature	Task	Verified
F-NAV-01	T07	✅ (grep count: 1)
F-SET-01	T07	✅ (grep count: 1)
F-UI-01	T07	✅ (grep count: 1)
F-UI-02	T07	✅ (grep count: 1)
F-UI-03	T07	✅ (grep count: 1)
F-UI-04	T07	✅ (grep count: 1)
F-UI-05	T07	✅ (grep count: 1)
F-UI-06	T07	✅ (grep count: 1)
F-UI-08	T07	✅ (grep count: 1)
F-SEC-02	T01	✅ (grep count: 1)
F-SEC-03	T01	✅ (grep count: 1)
F-SCHED-01	T01	✅ (grep count: 1)
F-DATA-03	T02	✅ (grep count: 1)
F-DATA-04	T02	✅ (grep count: 1)
F-DATA-06	T07	✅ (grep count: 1)
F-ENV-01	T08	✅ (grep count: 1)
F-INFRA-02	T08	✅ (grep count: 2)
F-INFRA-03	T01	✅ (grep count: 2)
F-TEST-01	All tasks	✅ (grep count: 10)

✅ MAJOR-2 (FIXED): F-DOC-01 — Dokumentation

• Task T10 covers F-DOC-01 with 3 acceptance criteria: README.md, Swagger UI, admin-guide.md, api-overview.md ✅
• Test command: test -f README.md && test -f docs/admin-guide.md && test -f docs/api-overview.md ✅

✅ MAJOR-3 (FIXED): F-INFRA-04 — Monitoring & Alerting

• Architecture §8d: Health endpoint, Prometheus metrics, alerting, structured logging ✅
• Task T10: 5 acceptance criteria + test_spec with test_monitoring.py ✅

✅ MAJOR-4 (FIXED): F-PERF-01 — Performance

• Architecture §8e: Indexing strategy, query optimization, frontend performance, performance tests ✅
• Task T10: 6 acceptance criteria + test_spec with test_performance.py ✅

✅ MAJOR-5 (FIXED): F-CONT-08 Phantom

• grep -n 'F-CONT-08' task_graph.json → 0 results ✅
• F-CONT-08 completely removed from all requirement_ids arrays ✅

✅ MINOR-1 (FIXED): api_tokens table in DB Schema

• DB Schema §2 (line 366-380): Full table definition with 9 columns + 2 indexes ✅
• Labeled "post-MVP, architecture ready" ✅
• Has tenant_id ✅

✅ MINOR-2 (FIXED): CSP-Header

• Architecture §6 (lines 1284-1291): Full CSP header + 5 additional security headers ✅
• DOMPurify/escaped rendering mentioned ✅
• Linked to F-SEC-02 ✅

✅ MINOR-3 (FIXED): Typo line 1033

• grep -n '```n' architecture.md → 0 results ✅
• No malformed code fences found anywhere in the file ✅

---

Feature Coverage Cross-Check (Programmatic)

Method: Regex extraction of all F-[A-Z]+-[0-9]+ patterns from requirements.md and task_graph.json, set difference.

Metric	Count
Unique features in requirements.md	140
Unique features in task_graph.json	136
Missing from task_graph (v2-Plugin, legitimately excluded)	4 (F-FILE-02, F-FILE-03, F-FILE-04, F-FILEUI-06)
Phantom features (in task_graph but not in requirements)	0
v1 features covered	134/134 (100%)
v2 features excluded	6/6 (F-FILE-01-04, F-FILEUI-05-06)

Note: F-FILE-01 and F-FILEUI-05 appear in requirements.md as [v2-Plugin] but are NOT in any task's requirement_ids array — they only appear in the coverage summary note text. This is correct behavior.

---

Architecture Section Inventory

Section	Lines	Status
§1 System Architecture	10-141	✅ Complete (diagram, services, backend/frontend structure)
§2 DB Schema	142-822	✅ Complete (Core + Plugin + AI + Workflow tables, FTS, api_tokens)
§3 API Design	823-1094	✅ Complete (all endpoints with Feature IDs, Copilot + Workflow endpoints added)
§4 Plugin Architecture	1095-1206	✅ Complete (Manifest, Lifecycle, Event Bus, DI, UI Framework)
§5 Multi-Tenant	1207-1233	✅ Complete (Session Context, ORM Auto-Filter, TenantMixin)
§6 Auth Architecture	1234-1311	✅ Complete (Session, RBAC, API Tokens, CSRF, CSP, Password Reset)
§7 Frontend Architecture	1312-1384	✅ Complete (Stack, Routing, State, i18n, A11Y, Design System)
§8 Deployment Architecture	1385-1482	✅ Complete (Docker Compose, .env, Backup)
§8b KI-Integration	1483-1537	✅ NEW — Complete (API endpoints, RBAC, DB table, frontend, impl model)
§8c Workflow Engine	1538-1661	✅ NEW — Complete (Hybrid approach, API, DB tables, step JSONB structure)
§8d Monitoring & Alerting	1662-1713	✅ NEW — Complete (Health endpoint, Prometheus, alerting, structured logging)
§8e Performance	1714-1776	✅ NEW — Complete (Indexing strategy, query optimization, frontend perf, tests)
§9 Test Strategy	1777-1824	✅ Complete (Backend, Frontend, E2E, test file tree updated)
§10 ADRs	1825-1888	✅ Complete (6 ADRs, ADR-05 updated for Redis+PostgreSQL session)
Open Questions	1889-1897	✅ Present
Handoff	1898-1904	✅ Present

Total: 1904 lines (was 1468 in Round 1) — 436 lines added for new sections.

---

Task Graph Inventory

Task	Title	Est. Lines	Dependencies	Test Spec	Acceptance Criteria
T01	Core Infrastructure + Multi-Tenant + Auth	500	—	✅ 3 commands	✅ 25 criteria
T02	Company + Contact + Import/Export	600	T01	✅ 3 commands	✅ 24 criteria
T03	Plugin System Framework	500	T01	✅ 3 commands	✅ 14 criteria
T04	DMS Plugin + Tags Plugin	700	T01, T03	✅ 4 commands	✅ 32 criteria
T05	Calendar Plugin	700	T01, T03	✅ 3 commands	✅ 29 criteria
T06	Mail Plugin	800	T01, T03	✅ 3 commands	✅ 40 criteria
T07	Frontend Core SPA	600	T01, T02	✅ 4 commands	✅ 32 criteria
T08	Frontend Plugins + Search + Deployment	700	T03-T07	✅ 6 commands	✅ 47 criteria
T09	KI-Copilot API + Hybrid Workflow Engine	700	T01, T02	✅ 3 commands	✅ 22 criteria
T10	Monitoring, Performance Testing, Documentation	500	T01, T02, T08	✅ 5 commands	✅ 16 criteria

• All tasks in 500-800 lines range ✅
• Every task has test_spec with commands, test_files, coverage_target ✅
• Every task has substantielle acceptance_criteria ✅
• 6-phase execution plan with parallelization ✅
• No micro-tasks ✅

---

AGENTS.md Verification

Build/Test Commands ✅

• Backend: venv setup, uvicorn, alembic, pytest, pytest-cov, mypy, ruff ✅
• Frontend: npm install, dev, build, vitest, tsc, eslint ✅
• Docker Compose: build, up, logs, down, config validate ✅
• E2E: Playwright install + test ✅

Forbidden Patterns ✅

• Backend: 14 patterns (SQLite, Jinja2, Cross-Tenant, Plaintext Passwords, JWT, Naive Datetime, Integer IDs, Hard-Delete ohne GDPR, Manual Tenant Filter, Sync I/O, Raw SQL, Secrets in Code, Unvalidated Input, Missing Audit Log, Plugin Tables ohne tenant_id) ✅
• Frontend: 10 patterns (Class Components, Inline Styles, Hardcoded Strings, Manual Fetch, Server Data in Zustand, any Types, Missing ARIA, Touch Targets <44px, Direct DOM, Unsafe HTML) ✅
• Deployment: 5 patterns (Root in Container, Exposed DB Port, No Health Check, No Volume, Secrets in compose) ✅

Task-Zuweisung ⚠️ PARTIAL

• Phasen-Plan table: Only 5 phases / 8 tasks — missing T09 (Phase 3) and T10 (Phase 6) ❌
• Task Assignment table: Only T01-T08 — missing T09 and T10 ❌
• Release Gate: "All 8 tasks complete" — should be 10 ❌
• Block Rules: "After 3 blocks (9 tasks)" — should reference 10 tasks ⚠️

---

Next Steps

1. [MAJOR] Update AGENTS.md Phasen-Plan table to include T09 in Phase 3 and add Phase 6 with T10
2. [MAJOR] Add T09 and T10 rows to Task Assignment table in AGENTS.md
3. [MAJOR] Update Release Gate in AGENTS.md to "All 10 tasks complete"
4. [MINOR] Update Block Rules in AGENTS.md to reference 10 tasks (4 blocks)
5. [MINOR] Fix feature_coverage_summary in task_graph.json: total_features should be 140, not 143
6. [MINOR] Consider renumbering §8b-§8e as top-level sections (not blocking)

---

Review Metadata

• Files reviewed: architecture.md (1904 lines), task_graph.json (571 lines), AGENTS.md (542 lines), requirements.md (2142 lines, reference), quality-gate-phase2.md (383 lines, previous review)
• Cross-check method: Programmatic Feature-ID extraction + set difference (Python regex/grep), targeted section reads
• Review method: Full verification of all 11 Round-1 issues + re-check of 10 original criteria + new issue detection
• Tools used: text_editor (read), code_execution_tool (grep/sed/python cross-check)

---

Verdict

✅ APPROVED_WITH_SUGGESTIONS

All 11 issues from Round 1 are resolved. All 10 original criteria pass (8 PASS, 1 PARTIAL due to AGENTS.md gap). No critical issues remain. One major issue (AGENTS.md not updated for T09/T10) is non-blocking for implementation start but must be fixed before Phase 3 execution.

Phase transition: APPROVED — Implementation may begin. AGENTS.md update should be done in parallel with T01 implementation.